ISO/IEC 27001:2022
ShiftOneZero d.o.o. has established and applies an information security management system (ISMS) in accordance with ISO/IEC 27001:2022. The certificate was issued by the accredited certification body ITC International Testing & Certification (IAF MLA member, IAS accredited).
Certificate ISMS 0826 002558
The certificate can be verified at www.itc-italia.net or via the QR code on the certificate itself.
Hosting and infrastructure
- EU data centres. Club platforms (ClubPulse, the GNK Dinamo website, app and webshop) run on Microsoft Azure in an EU region, with managed PostgreSQL databases in a replicated setup.
- Encrypted traffic. All traffic goes over HTTPS (TLS). Applications are never exposed directly to the internet — they are reachable only through a reverse proxy and CDN protection.
- Encrypted storage. Managed databases and cloud storage are encrypted at rest.
- Backups. Production databases have automatic backups and point-in-time restore.
- Separate environments. Development, testing and production are kept apart. Analysis and development use anonymised copies of data, never the live database.
Access and permissions
- Least privilege. Every user — and every integration — gets only the role it needs (e.g. administrator, manager, marketing, gate scanner).
- Production under control. Access to production databases is restricted, integrations are read-only, and any exceptional access needs explicit approval.
- Audit trail. Staff actions in back offices are recorded in a tamper-proof log — who changed what, and when.
- AI tools with guardrails. Where we use AI agents, they run with restricted permissions and have no access to personal data.
Secure development
- Secrets (keys, passwords, tokens) are never in source code — they live in protected environment configuration, and fresh keys are generated for production.
- Dependencies with known vulnerabilities fail the build — they cannot slip quietly into production.
- Webhooks are signed (HMAC-SHA256), outbound calls only go to allow-listed hosts, and public APIs are rate-limited.
- Personal data must never end up in logs, tickets or commits.
- Extensive automated tests and code review before every release.
GDPR built into our products
We don't handle privacy with a document at the end of a project, but with features in the product itself:
| Principle | What it looks like in practice |
|---|---|
| Right of access (Art. 15) | Export of all data about a person in machine-readable form, one click from the back office. |
| Right to erasure (Art. 17) | Erasure by anonymisation that can never stop half-way and is safe to repeat. |
| Storage limitation | Automatic daily purge according to defined retention periods, with a mandatory dry run and confirmation. |
| Data minimisation | We collect only what is needed. Where possible, sensitive identifiers (e.g. the Croatian OIB) are not stored — only a one-way hash is kept. |
| Consent | Consents and accepted terms are recorded with version and timestamp — e.g. separately for every prize game. |
| No unwanted messages | Systems that must not contact users technically cannot — the ability to send simply isn't built in. |
Us as a data processor
When we build and maintain systems for clients (e.g. a sports club, festival or nightclub), the client is the controller of its users' personal data and ShiftOneZero is the processor within the meaning of Art. 28 GDPR. We process data only on the client's documented instructions, under a data processing agreement (DPA), and we:
- ensure that everyone with access is bound by confidentiality;
- apply the technical and organisational measures of our ISO/IEC 27001 system;
- use sub-processors (e.g. cloud providers) only with the client's consent and under the same protection obligations;
- help the client fulfil data subject rights and impact assessments;
- return or delete the data at the end of the engagement, as the client chooses.
For the processing of users' data in a specific app (e.g. a fan app or webshop), that client's privacy policy applies.
Incident management
Security incidents are reported, logged and handled under a defined ISMS procedure. In the event of a personal data breach we notify the controller without undue delay, so they can meet their obligation to notify the supervisory authority within 72 hours and, where needed, inform the people affected.
Reporting a vulnerability
If you have found a security issue in one of our systems, email info@shiftonezero.com with the subject "Security". Please don't publish it until we have fixed it — we respond quickly and appreciate responsible disclosure.